Litestar is an asynchronous server gateway interface framework that allows developers to build event‑driven web applications. Versions earlier than 2.20.0 are affected when a template engine is combined with CSRF protection. In these configurations, the value of the CSRF cookie is inserted into rendered templates without the template engine applying the usual escaping rules, creating an HTML injection flaw that can be promoted to cross‑site scripting; untrusted cookie content can generate arbitrary script or markup within the user’s browser. When an attacker can influence the CSRF cookie value—typically by compromising the victim’s browser context—this flaw enables attackers to execute scripts in the victim’s context, leading to data leakage, session hijacking, or other exploitation outcomes.

The affected product is the Litestar ASGI framework from litestar‑org. Versions prior to 2.20.0 are vulnerable, where the combination of a template engine and CSRF protection is enabled per official configuration guidance. No other vendors or products are listed as affected.

The CVSS score of 8.1 marks this as a major vulnerability, while an EPSS score of less than 1% indicates a very low current exploitation probability. The flaw is not catalogued in the CISA KEV list. Because the flaw is triggered by user‑controllable content placed in a CSRF cookie, the attack vector likely requires the attacker to set a malicious CSRF cookie for the victim, which can be achieved only if the attacker can influence the victim’s browser context—such as via a separate XSS or phishing vector. When enabled, the malicious payload is rendered by the client’s browser, exposing the user to potential data theft or session compromise.